Hi all,
I am attempting to index a .json formatted file. Using the Splunk data checker, the fields are all extracted nicely using _JSON sourcetype (well done Splunk).
In my events there is a field named, "field.timestamp", that contains an epoch timestamp (13 digits) i want to use for the timestamp (no timestamp is recognised by default).
Here's a raw event:
{"field":{"timestamp":"1429306200000"}}
If I specify the field "field.timestamp" to Splunk as the field where the timestamp resides it still does not recognise any timestamp.
What would be a good way to extract this timestamp?
